sha256, sha512_256: switch to wolfCrypt API#21090
sha256, sha512_256: switch to wolfCrypt API#21090vszakats wants to merge 10 commits intocurl:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR switches the SHA-256 and SHA-512/256 implementations used under wolfSSL from the OpenSSL-compat EVP interface to the native wolfCrypt APIs, aligning these helpers with existing wolfCrypt usage patterns in the codebase.
Changes:
- Update
lib/sha256.cto usewc_InitSha256/wc_Sha256Update/wc_Sha256Finalwhen built with wolfSSL. - Update
lib/curl_sha512_256.cto usewc_InitSha512_256/wc_Sha512_256Update/wc_Sha512_256Finalwhen built with wolfSSL, and adjust backend-selection comments/logic accordingly.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| lib/sha256.c | Replaces wolfSSL EVP-compat SHA-256 usage with wolfCrypt SHA-256 API. |
| lib/curl_sha512_256.c | Replaces wolfSSL EVP-compat SHA-512/256 usage with wolfCrypt SHA-512/256 API and updates backend selection. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| size_t length) | ||
| { | ||
| Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context; | ||
| if(wc_Sha512_256Update(ctx, data, (word32)length)) | ||
| return CURLE_SSL_CIPHER; |
There was a problem hiding this comment.
wc_Sha512_256Update() takes a word32 length, but this code casts from size_t without any bounds check. For inputs > 4GiB this will truncate and compute an incorrect hash. Consider either rejecting length > UINT32_MAX with a clear error, or looping over the input in word32-sized chunks to support large buffers safely.
There was a problem hiding this comment.
Theoretically correct, but I'm fairly sure this function cannot be
called with >4GiB due to pre-existing outer limits.
Replacing the OpenSSL-like compatibility interface, and syncing with
existing API use within lib/wolfssl.c for SHA-256.
Ref: https://www.wolfssl.com/documentation/manuals/wolfssl/group__SHA.html
Follow-up to 28f0932 #21077
Follow-up to 988b352 #21078